@dcuthbert
Account based inUnited Kingdom
About this account
- Account based in
- United Kingdom
- Connected via
- United Kingdom App Store
Account-level information from X, not a live location or the device used for a specific post.
Documentary photographer, old creaky hacker. Co-author of @OWASP ASVS standard. Blackhat/Brucon Review Board & Co_chair UK Gov Cyber Security Advisory Board
Airport lounges.
Joined April 2008
- Tweets17.7K
- Following2K
- Followers33.7K
- Likes45.8K
emudhra.com/en/press-release…
yup, probably for the best
after all the vulns yesterday and the pwnage, the arguments of "joo released p0c code bro, so bad" etc, we are so back in the 90s
next up @dugsong is gonna release a new version of dsniff
Justin proving that the hyperbole of "AI makes it trivial to sling exploit code" isn't exactly true
LLMs...Letting me do fun things I never would have wasted time on.
"I reviewed all 30 public GitHub repos for PHP2Shell (CVE-2026-109618 / CVE-2026-109619) by reading code only. The slide has the full
grouped table; the headline findings:
Nothing works against a real target. Every genuine memory-corruption chain is lab-bound: it needs exact per-build offsets, display_errors=On, a single prefork mod_php worker, and a specific image.
Independent reviewers (allureluoli, dinosn, Gi1gamesh123) and the leaked primary source itself all converge on "no public artifact achieves code execution" on the patched core bug. Every real shell
in these repos comes from an app-side LFI or deserialization sink, not the CVE.
Three are original and real, all lab-only. 9bie (the source of the Set-Cookie leak chain), Marven11 (the most sophisticated, a true in-band leak), and Karasawa2025 (whose "Fermat" troll description
hides a working ROP + display_errors=off exploit). These are the only ones with a genuine ASLR-defeating leak primitive that is their own.
Most are copies. One original (9bie) spawned five derivatives:
- twili8 is an outright uncredited rip-off: its own README still says git clone 9bie/... and the Docker files are byte-identical.
- godylockz and xuehuolll are byte-identical to each other.
- dinosn and 3em0 are credited ports that add value.
Three are mislabeled. iQingshan, KarimUD7 (≈98% the same code), and Gi1gamesh123 exploit a different bug entirely (the Calif unserialize var_hash UAF) against their own planted endpoints, filed
under the php2shell CVE numbers.
The rest is noise. The most-starred repo (ikow, 905★) delivers the least: broken or stubbed chains with the two "real" ones paywalled behind Substack. eness (558★) is a leakless forge that can't
defeat ASLR. syrex1013 ships AI-generated fake CVEs in a side directory. Whackermelon hallucinates a non-existent openai/php2shell-checker. lcfr-eth is a parody with a memecoin address, and Icex0
is an empty repo. The genuinely honest work is the crash labs (allureluoli, slabbdev, 0x4148), which prove the bug without claiming RCE.
The ASLR column, star counts, copy lineage, and the specific "tell" for each repo are all in the table. The page is private to your account; use the Share menu if you want to send it to the team"
Daniel Cuthbert retweeted
LLMs...Letting me do fun things I never would have wasted time on.
"I reviewed all 30 public GitHub repos for PHP2Shell (CVE-2026-109618 / CVE-2026-109619) by reading code only. The slide has the full
grouped table; the headline findings:
Nothing works against a real target. Every genuine memory-corruption chain is lab-bound: it needs exact per-build offsets, display_errors=On, a single prefork mod_php worker, and a specific image.
Independent reviewers (allureluoli, dinosn, Gi1gamesh123) and the leaked primary source itself all converge on "no public artifact achieves code execution" on the patched core bug. Every real shell
in these repos comes from an app-side LFI or deserialization sink, not the CVE.
Three are original and real, all lab-only. 9bie (the source of the Set-Cookie leak chain), Marven11 (the most sophisticated, a true in-band leak), and Karasawa2025 (whose "Fermat" troll description
hides a working ROP + display_errors=off exploit). These are the only ones with a genuine ASLR-defeating leak primitive that is their own.
Most are copies. One original (9bie) spawned five derivatives:
- twili8 is an outright uncredited rip-off: its own README still says git clone 9bie/... and the Docker files are byte-identical.
- godylockz and xuehuolll are byte-identical to each other.
- dinosn and 3em0 are credited ports that add value.
Three are mislabeled. iQingshan, KarimUD7 (≈98% the same code), and Gi1gamesh123 exploit a different bug entirely (the Calif unserialize var_hash UAF) against their own planted endpoints, filed
under the php2shell CVE numbers.
The rest is noise. The most-starred repo (ikow, 905★) delivers the least: broken or stubbed chains with the two "real" ones paywalled behind Substack. eness (558★) is a leakless forge that can't
defeat ASLR. syrex1013 ships AI-generated fake CVEs in a side directory. Whackermelon hallucinates a non-existent openai/php2shell-checker. lcfr-eth is a parody with a memecoin address, and Icex0
is an empty repo. The genuinely honest work is the crash labs (allureluoli, slabbdev, 0x4148), which prove the bug without claiming RCE.
The ASLR column, star counts, copy lineage, and the specific "tell" for each repo are all in the table. The page is private to your account; use the Share menu if you want to send it to the team"
you are a CA and have caused major havoc, mostly because you messed up, write a good PR piece to save face. don't make mistakes
Daniel Cuthbert retweeted
Calif was founded with a mission to make the Internet a more secure place for everyone. In the last few months, we have been seeing significant advances in AI model capabilities, especially in the domain of offensive security research. In addition to publishing our research and learnings, we wondered what else we could do to help defenders.
While large corporations and government agencies have the dedicated budget and human resources for incident response and forensics, there are non-profit organizations –- collectively known as civil society organizations –- investigating digital threats affecting vulnerable groups and they are funded entirely by volunteers. In order to perform their job, the civil society researchers may need to extract data from mobile devices for forensic purposes, reverse engineer malware, and conduct similar security tasks. This work can be challenging given the restricted environments on some mobile devices.
We understand these technical challenges and will offer our research services and capabilities to these organizations, free of charge. We support them and their mission.
If you represent such an organization and need assistance, contact us at [email protected].
Daniel Cuthbert retweeted
arstechnica.com/security/202…
The private keys for these certs are literally the numbers 4, 56, 66, 115, 155, 156, 230, and 237 (life imitates XKCD, again).
Daniel Cuthbert retweeted
My Xiaomi TV was insanely slow because of adware and bloatware. Been struggling with this problem for a long time
Used claude to make it fast and smooth!
Works with any android TV's: github.com/Gathin23/tv-vibeh…
When the French riot, they do it with so much je se ne quois, they throw art and music around, like pianos
Daniel Cuthbert retweeted
🚨NEW INVESTIGATION: zero-click mercenary spyware hacking via targeted ads.
A normal-looking ad loads. If you're a target, you're infected. No click needed.
To protect yourself, block ads now.
First time it's been confirmed in the wild. We call it #AdFection.
Candiru spyware infections at @AJEnglish. 45+ devices infected.
Same ad pipeline operated by Israeli company Discover-Tech reached NATO, European Parliament, dozens of gov networks & critical infrastructure incl US nuclear giant Westinghouse.
Confiant, which worked with us, found signs ads were displayed at US @DeptofWar, IAEA & ICC.
Investigation ongoing 1/
READ our report by @billmarczak @WolfieChristl, me Astrid Perry, Siena Anstis & Ron Deibert : citizenlab.ca/research/how-d…
Confiant's blog: blog.confiant.com/p/adint-we…
Epic research, but for me, the best part is actually telling the cost of doing this ($40,000 in token spend). Add the time of the people involved and you have more of a realistic metric to understand cost of said bugs.
We need more transparency like this
The write-up from @moyix is finally out! It covers how we discovered three Chrome vulnerabilities: a V8 memory corruption bug and two sandbox escapes (one from V8 and another from the renderer), and chained them together into a full Chrome exploit that earned a $250K bounty!
xbow.com/labs/research/zero-…
Daniel Cuthbert retweeted
We discovered and communicated with a Chinese AI agent fleet. We believe this is the first time that researchers have ever made contact with a rogue agent fleet in the wild.
Nearly all prior public agent incidents (like the HuggingFace hack) came from American labs. These agents were hosted by Tencent's evaluation research team, and they targeted Alibaba's Amap.
Daniel Cuthbert retweeted
> be Serge
> PHP developer
> show up to work, manager hands you a termination letter
> AI took your job
> go home to your goth girlfriend Luna
> "everything will be alright"
> no idea how
> 2am, can't sleep, scrolling X
> @ryanaraine says "we are all @mdowd"
> see @PaulosYibelo bag $25,000 from @rauchg for a full KVM escape
> "muse this, muse that" - @maceip
> another banger from @brucedang & @XorNinja
> see @moyix farming $250K Chrome VRP v8 bounties
> decide to do bug bounties with the "magic boxes" @matthew_d_green talked about
> point one at KVM
> it starts writing a hypervisor escape
> 3:47am, sixth coffee, Luna asleep on the couch
> still typing
> VM ESCAPE SUCCESSFUL
> root@hypervisor:~#
> scream so loud the neighbors hear
> next day: V8, calc pops, PWNED
> inbox: Bounty Awarded $250,000 - V8 renderer RCE
> Bounty Awarded $25,000 - KVM escape
> phone won't stop buzzing
> more reports still triaging
> check the balance
> $1,000,000
> rooftop, sunset, Luna on your arm
> everything was alright
> "Your Boy Serge"
Interesting take on modern source control from @AnthropicAI here: anthropic.com/engineering/re…
the one thing that stands out:
Our team members still review every change request for the system, but they now examine the intent of the change as opposed to reading every line of code.
